Vulnerability Description
This issue was addressed by adding an additional prompt for user consent. This issue is fixed in macOS Monterey 12.7.4, macOS Sonoma 14.4, macOS Ventura 13.6.5. Third-party shortcuts may use a legacy action from Automator to send events to apps without user consent.
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apple | Macos | >= 12.0, < 12.7.4 |
References
- https://support.apple.com/en-us/120884
- https://support.apple.com/en-us/120886
- https://support.apple.com/en-us/120895
- http://seclists.org/fulldisclosure/2024/Mar/21Mailing List
- http://seclists.org/fulldisclosure/2024/Mar/22Mailing List
- http://seclists.org/fulldisclosure/2024/Mar/23Mailing List
- https://support.apple.com/en-us/HT214083Vendor Advisory
- https://support.apple.com/en-us/HT214084Vendor Advisory
- https://support.apple.com/en-us/HT214085Vendor Advisory
- https://support.apple.com/kb/HT214083
- https://support.apple.com/kb/HT214084
- https://support.apple.com/kb/HT214085
FAQ
What is CVE-2024-23245?
CVE-2024-23245 is a vulnerability with a CVSS score of 3.3 (LOW). This issue was addressed by adding an additional prompt for user consent. This issue is fixed in macOS Monterey 12.7.4, macOS Sonoma 14.4, macOS Ventura 13.6.5. Third-party shortcuts may use a legacy ...
How severe is CVE-2024-23245?
CVE-2024-23245 has been rated LOW with a CVSS base score of 3.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-23245?
Check the references section above for vendor advisories and patch information. Affected products include: Apple Macos.